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REAL PARTY IN INTEREST 

The Real Party in Interest in the present Appeal is International Business Machines 
Corporation, the assignee, as evidenced by the assignment set forth at Reel 010477, Frame 0042. 

RELATED APPEALS AND INTERFERENCES 

No related appeals or interferences are known to Appellant, Appellant's legal 
representative, or assignee, which will directly affect, or be directly affected by, or have a 
bearing on the Board's decision in the present Appeal. 

STATUS OF THE CLAIMS 

Claims 1-6, 8-10, 13-23, and 25 stand finally rejected by the Examiner as noted in the 
Final Office Action dated August 8, 2003, and are on appeal. 

STATUS OF THE AMENDMENTS 

No amendment was submitted subsequent to the Final Office Action. 

SUMMARY OF THE INVENTION 

As shown in Figures 1-4, Applicant's invention comprises a method, system, and 
computer program product for prompting a repeat user of a payment card at an interface terminal 
with additional security-related questions when the user selects responses that deviate from his or 
her typical selections. Page 9, lines 3-7. The payment card is read at the terminal, its line of 
credit is authorized, and a profile of the user's purchasing habits is retrieved. Page 9, lines 17- 
32. The user then enters his or her current selection of options. Page 10, lines 17-19. A 
determination is then made as to whether the user's current selections match his or her user 
profile. Page 10, lines 19-22. If the user's current selections match the user profile, the process 
allows the user to obtain the services or facilities. Page 10, lines 24-26. If the user's current 
selections do not match the user profile, the process queries the user with additional security 
questions to ascertain whether the current user is an authorized user. Page 10, lines 28-34. If the 
user is unable to answer the security questions correctly, the process prevents the user from 
accessing the services or facilities. Page 11, lines 10-15. If the user is able to answer the 
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security questions correctly, the process allows the current user to begin fueling his or her 
vehicle, for example. Page 11, lines 15-19. 

ISSUE 

Is the Examiner's rejection of the claims under 35 U.S.C. § 103(a) as being unpatentable 
over the cited references well founded? 

GROUPING OF THE CLAIMS 

For purposes of this appeal, all of the claims stand or fall together as one group. 

ARGUMENTS 

The Examiner finally rejected all of the claims under 35 U.S.C. § 103(a). The Examiner 
stated that claims 1-4, 6, 9, 14-16, 18-21, and 23 are unpatentable over Findley, claims 8, 13, 17, 
and 25 are unpatentable over Findley in view of Kanevsky, and that claims 5, 10, and 22 are 
unpatentable over Findley in view of Penzias, Final Office Action, pages 2 and 3. 

The primary cited reference, Findley^ discloses an efficient method of detecting 
attempted unauthorized use of credit cards via remote purchase by telephone. Although on the 
surface this reference appears to be similar to Applicant's invention, there are several 
fundamental differences. Findley is designed to "limit its exposure to repetitive theft from the 
same merchandise category." Column 4, lines 59-61. In direct contrast, Applicant's invention is 
designed to encourage and protect repetitive purchases of the same merchandise. Put another 
way, Findley 's system and method triggers a security hold on an account if the behavior of the 
user becomes too consistent, where as Applicant's system and method reacts to behavior that 
deviates from a consistent pattern. 

Perhaps the easiest explanation for this first fundamental difference is that Findley is 
designed to monitor activity made from any telephone in the world for purchases selected from a 
massive array of products and/or services. Because of the potentially random use of telephones 
and the enormous variety of purchases, Findley is understandably highly focused on the 
telephone calling patterns and credit card usage habits of authorized users. In contrast, 
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Applicant's invention is designed to work with direct, user-interface terminals (e.g., gas stations) 
where the user is actually standing at the provider's terminal and is purchasing from a relatively 
limited supply of goods and/or services for receipt thereof at the terminal. Because the 
purchasing habits of users who frequent direct user-interface terminals tend to be extremely 
consistent, Applicant's invention does not address calling patterns (i.e., how or where the 
terminal is engaged) or credit card usage habits (e.g., dollar amounts, time since last purchase, 
etc.). Rather, Applicant focuses on analyzing the consistency of the current selection of goods 
and/or services at the terminal. 

It is practically inconceivable that Findley would be applied at a direct user-interface 
terminal. By way of illustration, consider one of the example transactions described in Findley 
itself, compared to a transaction by a user of Applicant's invention at an automobile refueling 
station. A credit card customer that is using a telephone will tend to purchase different goods or 
services every time they pick up the phone. Occasionally, a repeat customer may desire to 
purchase one or two of the same goods or services, or perhaps multiple items for friends or 
family members. However, it is improbable that a repeat customer of, for example, a bookstore, 
a clothing purveyor, or an electronics store, will purchase the same set of books, clothes, or 
electronics with every return visit. It is exactly this type of behavior that Findley is designed to 
detect and prevent. Thus, it is antithetical to suggest that Findley be applied to an application 
wherein highly consistent purchasing behavior is the norm. 

However, a user of Applicant's invention at an automobile refueling station will tend to 
make the same purchase decisions for goods and/or services every time. For example, the user 
may always purchase premium unleaded fuel, and always purchase an economy car wash. 
Rather than trigger a security alert as would be the case with Findley, Applicant's invention 
automatically allows such consistent behavior by the user to proceed unimpeded in order to 
expedite the transaction. In other words, Findley is great for conventional telephone credit card 
shopping where goods or services number in the millions, and access is virtually unlimited, but it 
is inappropriate for direct, at-the-terminal, self-service transaction applications such as the one 
described above. 
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Another fundamental difference between Findley and Applicant's invention is that 
Findley does not analyze the actual goods and/or services being selected by the user. At best, 
Findley observes the "merchandise category" (column 4, lines 60-61) in which the goods may be 
classified. However, the point-of-sale terminals for which Applicant's invention is designed will 
inherently all fall within the same category (e.g., gas station services). Moreover, Findley 
teaches one skilled in the art to guard against "repetitive theft from the same merchandise 
category," which is the opposite of Applicant's invention. 

The other factors ("history factors") used by Findley to analyze purchasing behavior are 
also clearly defined. Column 3, line 50, through column 5, line 30. The most important factor, 
the origin history factor (OHF), analyzes all of the telephone numbers, via Caller ID, from which 
previous purchases were made. Column 2, lines 40-42. Applicant's invention is not concerned 
with this factor since all purchases made under Applicant's invention originate at the provider's 
very own point-of-sale terminal. Another factor use by Findley is the dollar purchase amount 
(D). Column 4, line 8. Applicant is not concerned with the dollar amount purchased by users 
within its system since, again, a typical user will rarely vary his grade of fuel, amount of fuel, 
and quality level of car wash purchased. Findley is also concerned with time between purchases 
(P) and the number of different credit cards used (column 4, lines 22-25), while Applicant does 
not address these issues. Thus, Findley analyzes an entirely different set of criteria for detecting 
fraud than Applicant. 

Each of the independent claims highlights at least one fundamental difference between 
Applicant's invention and Findley, namely, the ability to analyze the selection of actual goods 
and/or services by the user. For example, each of the independent claims specifically focuses on 
the "selection of goods and/or services," and "options for goods and/or services." There is no 
teaching or suggestion in Findley that is directed to the specific goods or services either 
previously selected by the authorized user, or currently selected by the present user. At the very 
most, Findley can be said to examine a "merchandise category," but even that level of scrutiny is 
limited to guarding against repetitive theft, which is completely antithetical to Applicant's 
invention as discussed at length above. 
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In addition to this requirement, claims 6 and 23 also state that the user is not required to 
answer the security-related question, "if the user's current Selections match the prestored 
selections or are within a desired range of consistency with the prestored selections. " Findley 
makes no provision for analyzing a range of goods and/or services selected during a current 
purchase with those made during previous purchases. 

Claims 9 and 19 go even further than claim 1 by generating user profiles of the goods 
and/or services in response to the previous selections made by the user. A current user is then 
analyzed with respect to his or her current selection of goods and/or services by comparing the 
items selected. In addition, if the goods and/or services selected by the current user do not match 
the user profile of goods and/or services, or are not within a desired range of consistency with the 
prestored selections of goods and/or services, then the current user must correctly answer a 
security-related question. 

The other cited references, Kanevsky and Pentias, merely stand for the propositions of 
questioning a user to provide access control, and protecting multiple account numbers, 
respectively. However, since the primary cited reference has been effectively disqualified, the 
arguments for these references are moot. 

It is respectfully urged that the claims are in condition for allowance and favorable action is 
requested. Please charge IBM Corporation Deposit Account No. 09-0447 in the amount of 
$320.00 for the Appeal Brief fee. If any additional fees are required, please charge IBM 
Corporation Deposit Account No. 09-0447. 



Respectfully submitted, 
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APPENDIX 

1. A method for automatically authorizing a remote point of purchase action at a facility 
which permits such actions, said method comprising the steps of: 

storing selections of goods and/or services made by an authorized user during a previous 
transaction; 

prompting a user with options for selecting goods and/or services during a current 
transaction at the facility; 

comparing the options for goods and/or services selected by the user with the user's 
prestored selections of goods and/or services; 

requiring the user to answer a security-related question if the options for goods and/or 
services selected by the user are inconsistent with the user ! s prestored selections of goods and/or 
services; and 

thereafter permitting the current transaction only if the user correctly answers said 
security-related question. 

2. The method of claim 1 wherein the step of storing selections comprises generating a user 
profile of selections of goods and/or services made by the user during the last n transactions. 

3. The method of claim 1 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the user at a plurality of facilities. 

4. The method of claim 1 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the user while using a credit or debit card. 

5. The method of claim 1 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the user while using a plurality of credit or debit cards, 
wherein each of the credit or debit cards has a different account number. 
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6. The method of claim 1 wherein the step of requiring the user to answer a security-related 
question is not required if the user's current selections 4 match' the prestored selections or are 
within a desired range of consistency with the prestored selections. 

8. The method of claim 1 wherein the step of requiring the user to answer a security-related 
question entails requiring the user to answer a plurality of security-related questions, and wherein 
the step of permitting the current transaction requires the user to answer each of the security- 
related questions correctly. 

9. A method for automatically authorizing a remote point of purchase action with a credit or 
debit card at facilities which permit such actions, said method comprising the steps of: 

storing selections of goods and/or services made by an authorized user during the 
previous n transactions with the credit or debit card at the facilities and generating a user profile 
of goods and/or services in response thereto; 

prompting a current user with options for goods and/or services during a current 
transaction with the credit or debit card at one of the facilities; 

comparing the options for goods and/or services selected by the current user with the user 
profile of goods and/or services; 

requiring the current user to answer a security-related question if the options for goods 
and/or services selected by the current user do not match the user profile of goods and/or 
services, or are not within a desired range of consistency with the prestored selections of goods 
and/or services; and then 

permitting the current transaction only if the current user correctly answers said security- 
related question. 

10. The method of claim 9 wherein the step of storing selections comprises storing selections 
of goods and/or services made by the authorized user while using a plurality of credit or debit 
cards at various ones of the facilities, wherein each of the credit or debit cards has a different 
account number. 
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13. The method of claim 9 wherein the step of requiring the current user to answer a security- 
related question entails requiring the current user to answer* a plurality of security-related 
questions, and wherein the step of permitting the current transaction requires the current user to 
answer each of the security-related questions correctly. 

14. A system for automatically authorizing a remote point of purchase action at a facility 
which permits such actions, comprising: 

a memory for storing previous selections of goods and/or services made by an authorized 

user; 

a user terminal adapted to prompt a user with options for goods and/or services during a 
transaction at the facility; 

processor means for comparing options for goods and/or services selected by the user at 
the user terminal during a current transaction with the previous selections of goods and/or 
services stored in the memory; 

control means for requiring the user to answer a security-related question when the 
options for goods and/or services selected by the user at the user terminal during the current 
transaction do not match the previous selections of goods and/or services stored in the memory, 
or are not within a desired range of consistency with the previous selections of goods and/or 
services, and for thereafter permitting the current transaction only when the user correctly 
answers said security-related question. 

15. The system of claim 14 wherein the memory generates a user profile of selections of 
goods and/or services made by the user during the last n transactions. 

16. The system of claim 14 wherein the user terminal is a device for reading a credit or debit 
card. 

17. The system of claim 14 wherein the control means requires the user to correctly answer a 
plurality of security-related questions. 
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18. A computer program product, residing on a computer usable medium and having 
computer usable program means embodied therein, sqid cofnputer usable program means 
comprising: 

means for storing selections of goods and/or services made by an authorized user during a 
previous transaction; 

means for prompting a user with options for goods and/or services during a current 
transaction at the facility; 

means for comparing options for goods and/or services selected by the user with the 
prestored selections of goods and/or services; 

means for requiring the user to answer a security-related question if the options for goods 
and/or services selected by the user do not match the prestored selections of goods and/or 
services, or are not within a desired range of consistency with the prestored selections of goods 
and/or services; and 

means for permitting the current transaction only if the user correctly answers said 
security-related question. 

19. The computer program product of claim 18 wherein the means for storing selections 
generates a user profile of selections of goods and/or services made by the user during the last n 
transactions. 

20. The computer program product of claim 18 wherein the means for storing selections 
stores selections of goods and/or services made by the user at a plurality of facilities. 

21. The computer program product of claim 18 wherein the means for storing selections 
stores selections of goods and/or services made by the user while using a credit or debit card. 

22. The computer program product of claim 18 wherein the means for storing selections 
stores selections of goods and/or services made by the user while using a plurality of credit or 
debit cards, wherein each of the credit or debit cards has a different account number. 
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23. The computer program product of claim 18 wherein the means for requiring the user to 
answer a security-related question is predicated on the user's current selections of goods and/or 
services being substantially inconsistent with the prestored selections of goods and/or services. 

25. The computer program product of claim 18 wherein the means for requiring the user to 
answer a security-related question entails requiring the user to answer a plurality of security- 
related questions, and wherein the means for permitting the current transaction requires the user 
to answer each of the security-related questions correctly. 
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